GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-2868 (GCVE-0-2023-2868)

Vulnerability from cvelistv5 – Published: 2023-05-24 18:00 – Updated: 2025-10-21 23:05
VLAI CISA Previdian
Title
Remote Code injection in Barracuda Email Security Gateway
Summary
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
SSVC
Exploitation: active Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 15:36 UTC
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
Barracuda Barracuda Email Security Gateway Affected: 5.1.3.001 , < 9.2.0.006 (custom)
guessed Create a notification for this product.
Date Public
2023-05-23 10:00
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 3ee4c088-3947-42e2-8846-739ec86c9420

Vulnerability ID: CVE-2023-2868

Status: Confirmed

Status Updated: 2023-05-26 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2023-05-26
Asserted: 2023-05-26
Scope
Notes: KEV entry: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | Affected: Barracuda Networks / Email Security Gateway (ESG) Appliance | Description: Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://status.barracuda.com/incidents/34kx82j5n4q9; https://nvd.nist.gov/vuln/detail/CVE-2023-2868
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-20
Feed CISA Known Exploited Vulnerabilities Catalog
Product Email Security Gateway (ESG) Appliance
Due Date 2023-06-16
Date Added 2023-05-26
Vendorproject Barracuda Networks
Vulnerabilityname Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: b252dbcc-bd89-48c9-9097-baa8d2f9a9e0

Vulnerability ID: CVE-2023-2868

Status: Confirmed

Status Updated: 2023-05-26 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2023-05-26
Asserted: 2023-05-26
Scope
Notes: KEVIntel entry: Remote Code injection in Barracuda Email Security Gateway | Affected: Barracuda / Barracuda Email Security Gateway | CVSS: 9.4 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title Remote Code injection in Barracuda Email Security Gateway
Vendor Barracuda
Product Barracuda Email Security Gateway
Added Date 2023-05-26T00:00:00.000Z
Cvss Score 9.4
Epss Score None
Cvss Severity CRITICAL
Epss Percentile None
Used In Malware unknown
Ahead Of Cisa Kev None
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:05 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:33:06.053Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.barracuda.com/company/legal/esg-vulnerability"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://status.barracuda.com/incidents/34kx82j5n4q9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2868",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T15:36:08.898946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-05-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:47.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-05-26T00:00:00.000Z",
            "value": "CVE-2023-2868 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Barracuda Email Security Gateway",
          "vendor": "Barracuda",
          "versions": [
            {
              "lessThan": "9.2.0.006",
              "status": "affected",
              "version": "5.1.3.001",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-05-23T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\u0026nbsp;The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\u0026nbsp;This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances."
            }
          ],
          "value": "A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\u00a0The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\u00a0This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-253",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-253 Remote Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-24T18:00:52.360Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://www.barracuda.com/company/legal/esg-vulnerability"
        },
        {
          "url": "https://status.barracuda.com/incidents/34kx82j5n4q9"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code injection in Barracuda Email Security Gateway",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2023-2868",
    "datePublished": "2023-05-24T18:00:52.360Z",
    "dateReserved": "2023-05-24T14:24:16.482Z",
    "dateUpdated": "2025-10-21T23:05:47.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-2868",
      "cwes": "[\"CWE-20\"]",
      "dateAdded": "2023-05-26",
      "dueDate": "2023-06-16",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://status.barracuda.com/incidents/34kx82j5n4q9;  https://nvd.nist.gov/vuln/detail/CVE-2023-2868",
      "product": "Email Security Gateway (ESG) Appliance",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.",
      "vendorProject": "Barracuda Networks",
      "vulnerabilityName": "Barracuda Networks ESG Appliance Improper Input Validation Vulnerability"
    },
    "epss": {
      "cve": "CVE-2023-2868",
      "date": "2026-09-16",
      "epss": "0.87691",
      "percentile": "0.99751"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-06-16",
      "cisaExploitAdd": "2023-05-26",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "Barracuda Networks ESG Appliance Improper Input Validation Vulnerability",
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.3.001\", \"versionEndIncluding\": \"9.2.0.006\", \"matchCriteriaId\": \"F270DBDA-EE31-4AF0-8743-D742467485CF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"824DAE15-3628-4346-947E-C33FA46AADE6\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.3.001\", \"versionEndIncluding\": \"9.2.0.006\", \"matchCriteriaId\": \"4A9B9E0B-F8D4-4626-AD39-BD525D638693\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACD3DD62-D690-47F9-8416-61AD78B33699\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.3.001\", \"versionEndIncluding\": \"9.2.0.006\", \"matchCriteriaId\": \"83D228EA-35C8-4B6E-9D22-CF0F7C20362B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6C507D86-2E68-44A4-A31C-EEF9A6BBEE54\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.3.001\", \"versionEndIncluding\": \"9.2.0.006\", \"matchCriteriaId\": \"8ADAC6B0-DE92-41F6-B8B1-1C830BB70C24\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"74D999D5-6CE5-49F7-A0C5-0B44704FEE45\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1.3.001\", \"versionEndIncluding\": \"9.2.0.006\", \"matchCriteriaId\": \"C5A27A43-E632-4C8A-A9F8-49C6E091E7ED\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FFA6EA4B-B0FF-437B-A48E-F11D0CD5EB2B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\\u00a0The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\\u00a0This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.\"}]",
      "id": "CVE-2023-2868",
      "lastModified": "2024-11-21T07:59:27.373",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cve-coordination@google.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 9.4, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2023-05-24T19:15:09.363",
      "references": "[{\"url\": \"https://status.barracuda.com/incidents/34kx82j5n4q9\", \"source\": \"cve-coordination@google.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.barracuda.com/company/legal/esg-vulnerability\", \"source\": \"cve-coordination@google.com\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://status.barracuda.com/incidents/34kx82j5n4q9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.barracuda.com/company/legal/esg-vulnerability\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve-coordination@google.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cve-coordination@google.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-2868\",\"sourceIdentifier\":\"cve-coordination@google.com\",\"published\":\"2023-05-24T19:15:09.363\",\"lastModified\":\"2026-06-17T05:53:39.770\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\u00a0The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\u00a0This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.\"}],\"affected\":[{\"source\":\"cve-coordination@google.com\",\"affectedData\":[{\"vendor\":\"Barracuda\",\"product\":\"Barracuda Email Security Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"5.1.3.001\",\"lessThan\":\"9.2.0.006\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-01-16T15:36:08.898946Z\",\"id\":\"CVE-2023-2868\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2023-05-26\",\"cisaActionDue\":\"2023-06-16\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Barracuda Networks ESG Appliance Improper Input Validation Vulnerability\",\"weaknesses\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.3.001\",\"versionEndIncluding\":\"9.2.0.006\",\"matchCriteriaId\":\"F270DBDA-EE31-4AF0-8743-D742467485CF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"824DAE15-3628-4346-947E-C33FA46AADE6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.3.001\",\"versionEndIncluding\":\"9.2.0.006\",\"matchCriteriaId\":\"4A9B9E0B-F8D4-4626-AD39-BD525D638693\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACD3DD62-D690-47F9-8416-61AD78B33699\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.3.001\",\"versionEndIncluding\":\"9.2.0.006\",\"matchCriteriaId\":\"83D228EA-35C8-4B6E-9D22-CF0F7C20362B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C507D86-2E68-44A4-A31C-EEF9A6BBEE54\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.3.001\",\"versionEndIncluding\":\"9.2.0.006\",\"matchCriteriaId\":\"8ADAC6B0-DE92-41F6-B8B1-1C830BB70C24\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74D999D5-6CE5-49F7-A0C5-0B44704FEE45\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1.3.001\",\"versionEndIncluding\":\"9.2.0.006\",\"matchCriteriaId\":\"C5A27A43-E632-4C8A-A9F8-49C6E091E7ED\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFA6EA4B-B0FF-437B-A48E-F11D0CD5EB2B\"}]}]}],\"references\":[{\"url\":\"https://status.barracuda.com/incidents/34kx82j5n4q9\",\"source\":\"cve-coordination@google.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.barracuda.com/company/legal/esg-vulnerability\",\"source\":\"cve-coordination@google.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://status.barracuda.com/incidents/34kx82j5n4q9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.barracuda.com/company/legal/esg-vulnerability\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T11:41:44+00:00",
      "cve": "CVE-2023-2868",
      "id": "CVE-2023-2868",
      "initial_release_date": "2023-05-23T10:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Remote Code injection in Barracuda Email Security Gateway",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-2868.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.barracuda.com/company/legal/esg-vulnerability\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://status.barracuda.com/incidents/34kx82j5n4q9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T06:33:06.053Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-2868\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-16T15:36:08.898946Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2023-05-26\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-05-26T00:00:00+00:00\", \"value\": \"CVE-2023-2868 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-2868\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T18:32:05.259Z\"}}], \"cna\": {\"title\": \"Remote Code injection in Barracuda Email Security Gateway\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-253\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-253 Remote Code Inclusion\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Barracuda\", \"product\": \"Barracuda Email Security Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1.3.001\", \"lessThan\": \"9.2.0.006\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2023-05-23T10:00:00.000Z\", \"references\": [{\"url\": \"https://www.barracuda.com/company/legal/esg-vulnerability\"}, {\"url\": \"https://status.barracuda.com/incidents/34kx82j5n4q9\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\\u00a0The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\\u00a0This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives).\u0026nbsp;The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl\u0027s qx operator with the privileges of the Email Security Gateway product.\u0026nbsp;This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"shortName\": \"Google\", \"dateUpdated\": \"2023-05-24T18:00:52.360Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-2868\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:05:47.195Z\", \"dateReserved\": \"2023-05-24T14:24:16.482Z\", \"assignerOrgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"datePublished\": \"2023-05-24T18:00:52.360Z\", \"assignerShortName\": \"Google\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.